microsoft / mu_basecore

Project Mu BaseCore
https://microsoft.github.io/mu/
Other
239 stars 122 forks source link

Fix buffer overrun in FTWDxe driver #1045

Closed sureshkumarpMSFT closed 3 days ago

sureshkumarpMSFT commented 1 month ago

Description

There is buffer overrun in FtwGetLastWriteHeader function when the buffer examined is malformed. In this case the code is trying to access beyond FtwWorkSpaceSize in any of the code prior to (Offset >= FtwWorkSpaceSize) check

Changed the code to anticipate this early and terminate the loop earlier when offset + EFI_FAULT_TOLERANT_WRITE_HEADER is greater than FtwWorkSpaceSize

How This Was Tested

Tested this in platform which has a SPI chip with improper firmware blocks. Without this fix boot crashed and with this change system continued to boot.

Integration Instructions

N/A

codecov-commenter commented 1 month ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 1.35%. Comparing base (11d1a1c) to head (f9d9cd3). Report is 4 commits behind head on release/202311.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## release/202311 #1045 +/- ## ================================================== - Coverage 1.35% 1.35% -0.01% ================================================== Files 1304 1304 Lines 333854 333857 +3 Branches 5103 5103 ================================================== Hits 4512 4512 - Misses 329259 329262 +3 Partials 83 83 ``` | [Flag](https://app.codecov.io/gh/microsoft/mu_basecore/pull/1045/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=microsoft) | Coverage Δ | | |---|---|---| | [MdeModulePkg](https://app.codecov.io/gh/microsoft/mu_basecore/pull/1045/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=microsoft) | `0.68% <ø> (ø)` | | Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=microsoft#carryforward-flags-in-the-pull-request-comment) to find out more.

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

os-d commented 3 days ago

Closing in favor of: https://github.com/microsoft/mu_basecore/pull/1131.